pre-commit-review

Pre-Commit Security Review

MTK File Resolution

MTK files (hooks/, .claude/references/, .claude/review-config.json) live either in the project (local install) or the plugin cache (marketplace install). Resolve once:

1. If $MTK_HELPER_ROOT is set, prefix hooks/, .claude/references/, and .claude/review-config.json reads with it — a pinned checkout wins over every other source.
2. Otherwise, if $CLAUDE_PLUGIN_ROOT is set, prefix them with that.
3. Otherwise, if hooks/pre-commit-linters.sh exists locally → project-relative paths work as-is.
4. Otherwise, fall back to find ~/.claude/plugins -maxdepth 8 -name "pre-commit-linters.sh" -path "*/mtk/*" -type f 2>/dev/null | sort -V | tail -1 | sed 's|/hooks/pre-commit-linters.sh||'. If empty, skip the linter pass and run the AI review only.

---

Run a fast, security-focused review on staged changes only. This is the lightweight check engineers should run before every commit.

Process

1. Get the staged diff: git diff --cached
2. If nothing staged, check unstaged: git diff
3. If nothing at all, tell the engineer there's nothing to review
4. Run the static linter pass first: bash hooks/pre-commit-linters.sh
   • Emits deterministic findings with source: "linter" and confidence: 100
   • Findings include secrets, raw SQL interpolation, connection strings with plaintext passwords, AWS keys, JWTs, and stack-specific patterns
   • Merge linter findings into your final JSON output (they always pass the threshold, so they always surface) 4.5. Merge cached analyzer output (if available). If .mtk/analyzer-output.json exists and was modified within the last 10 minutes, read it and filter findings to only those whose file field matches a file in git diff --cached --name-only (or git diff --name-only if using unstaged). Discard all other findings — surfacing repo-wide warnings on an unrelated commit erodes trust in the gate. Merge the filtered set into your output with source: "analyzer" and confidence: 100. Do NOT run the build yourself — the pre-commit gate must stay fast (seconds, not minutes). Only consume cached output. 4.6. Roslyn MCP tools (if available, .NET only). If dotnet-claude-kit is installed and the DetectAntiPatterns tool is available, call it on the changed files for on-demand semantic analysis. Treat results as source: "analyzer", confidence: 100. This is fast (analyzes specific files, not full build) and catches EF Core, async, and disposal patterns that the regex linter misses. If the tool is not available, skip this step. 4.6. Collateral-churn check. Run bash hooks/collateral-guard.sh --cached (add --manifest docs/specs/<date>-<slug>.json when this commit belongs to a spec). It answers a question no other check asks: is this churn yours? It flags whitespace/EOL-only rewrites (a small edit to a CRLF file rewrites the whole file), generated artifacts riding along undeclared (one npm install drags a lockfile into a feature commit), and asset directories regenerated wholesale. Findings are warnings, not blocks — but each carries a working revert command, and a commit whose diff is mostly collateral hides the real change from every reviewer downstream. The dependency gate below is the separate, stricter question of what the lockfile churn contains.